4 ms·
The actual exploit stuxnet used to get onto Windows PCs didn't require the computer to have autorun turned on. The exploit runs on all newer versions of Windows
by adimitrov 14y ago
The actual exploit stuxnet used to get onto Windows PCs didn't require the computer to have autorun turned on. The exploit runs on all newer versions of Windows (XP-7) and it triggers by browsing the device's contents with Explorer. (Specifically, it exploits a method Explorer uses to show icons on .lnk (Windows' sym-links) files.)
http://www.geek.com/articles/news/new-stuxnet-usb-exploit-threatens-windows-users-20100719/ http://www.geek.com/articles/news/new-stuxnet-usb-exploit-th...
- morsch 14y agoYou're corroborating the grand-parent's point that Windows PCs autorun everything you stick into them. Granted, in this case it's not by design, but still...
- adimitrov 14y agoThat's kinda the point: blaming autorun will make people who are "smart" enough to switch off autorun feel secure. But they aren't. There are vulnerabilities far more insidious than autorun.
- excuse-me 14y agoGood job there are no Windows machines used for any critical infrastructure in our country then.
- fdr 14y agoThe most interesting information in here to me by far: > In an interesting twist, it was discovered that the Stuxnet > malware group makes use of device drivers which were digitally > signed to make them appear as though they originated from > hardware vendor Realtek Semiconductor Corp. The digital > certificate has since been revoked but it is worrying that > malware writers seemingly had access to a private key issued to > a trusted supplier of device drivers.